Failed to apply On-fabrci rules

[Rsoufiane]

Hi, We have aroud 3k Forticlients used to establish a SSL/IPSec VPN with a fortigate.They are managed by a FortiEMS

On FortiEMS, we configured "on-fabric detection rules" with a LocalIP/subnet rule type so that the forticlient detects when the user is off fabric (when his IP changes) and shows him a list of VPN that he can connect to. The problem (i think) is when the user is at home, the FC doens't detect the change in the IP adress and consider him still "on fabric" so he doesn't show him the VPN list.

We tried ipconfig/release and renew and reload the computer but the problem persist. Versions : FC : 6.4.4.1655 and FEMS 6.4.4 build 1658

Thank you.

[fcb]

that's exactly right.... If you are "off-net" but cannot reach EMS, you'll not be able to talk to the server and get the other policy for "off-net". We setup split DNS so that our EMS server is accessible from the inside or outside. (ie: ems.yourdomain.com = 12.13.14.15 or your WAN IP block and ems.yourdomain.com on the inside = 10.11.12.13) All you need is a VIP on your gate to allow TCP.8013 into the EMS from the WAN